0

I want to hide the links to my server address in my Android app. When my app is decompiled, the links are clearly showing. Even with the proguard enabled I am not able to hide links. How can I protect these links?

2
  • 3
    Hiding links is bad idea. Protecting them with required authentication and authorization may help.
    – Cthulhu
    Commented Sep 10, 2015 at 7:30
  • 2
    Why do you want to hide your server-address?
    – anion
    Commented Dec 13, 2020 at 10:38

2 Answers 2

0

Short Answer

No matter how well you may obfuscate/hide a URL:

  • It is a waste of time.

Why?

1. DNS Lookups

All software (including your app) has to do a DNS lookup before it can connect to any URL.

Any computer running Linux can be set up as a local DHCP/DNS cache.

It could log all DNS requests, and forward requests to any public DNS server so your app is none the wiser, but your server's domain name is logged in clear text.

This may be very difficult to mitigate/detect in your app depending on network setup etc.

2. RAM Dumps

Before your app can do the DNS query it has to de-obfuscate or decrypt your URL.

This is (just about) impossible without storing the clear text version temporarily in RAM.

Running an app in an Android emulator and dumping all it's data from RAM is not difficult with know-how. (Just tedious)

3. Collective experience

People with reverse engineering and network security backgrounds are usually very experienced, and there are MANY of them.

Do you honestly think you can outsmart all of them?

1
  • yes i honestly admit it was such a newbie question
    – Thiyagu
    Commented Dec 15, 2020 at 8:55
9

This is a fool's errand. Even if you you could obfuscate them sufficiently in the source code, it would still be child's play to hook the device up to a proxy like Fiddler or Burp Suite, and see the raw URLs plain as day when the app is running. No need to look at your source code at all, and there is absolutely nothing you can do about protecting HTTP requests, and even HTTPS requests in this case, for several reasons.

So, was suggested in the comment, you need to protect the endpoints exposed by your server via authentication and authorization. Disguising the address is simply not a viable option.

3
  • Couldn't you configure an HTTP/HTTPS proxy to provide a public facing service and have it transmit the data to the real server securely via SOCKS5 or something similar?
    – Desthro
    Commented Jun 10, 2016 at 14:33
  • @Desthro that hides the physical server, but you still have the same problem that if the users have the public URLs, they can call it from outside the app. So, it makes the system more complex, but doesn't add any protection against this particular threat.
    – Xander
    Commented Jun 10, 2016 at 14:43
  • ah I was misunderstanding what the threat was. It just sounded like the OP was trying to obfuscate his/her personal server.
    – Desthro
    Commented Jun 10, 2016 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .